Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-11-2024 11:45
General
-
Target
Microsoft-Flight-Simulator-2024-Crack-main/Microsoft Flight Simulator 2024 Setup.exe
-
Size
570KB
-
MD5
d9d221384b7ac1af1cb64bd042cb16e3
-
SHA1
6a7c441f093ed49fa0f708a52a830e62ec2f5ce9
-
SHA256
46d8066bf56c854646b39a04ad298ac22c81f3c9545bb439763c91e40bdc0655
-
SHA512
dc52905cce2ee9bb75b15116c5f825ff295ca256bfc2c12d3cab349aaa2916cbd1970e142ff9a296ee80734b719cca68d5519c7328d18d51bbd3d482228f0b8d
-
SSDEEP
12288:ro3gygylSwAN2kLkhn23cVkolDApUPnR7YYRFyrcHvra9lr7v:U3gygnN2kLktscVkolDApUfR7vRFyQWL
Score
10/10
Malware Config
Extracted
Family
lumma
C2
https://fumblingactor.cyou/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360KB
-
Filesize
360KB
-
Filesize
576KB
-
Filesize
4KB